emotet | 6f589e1d533cecf8a0a098a349c072dc2f6021a77bbca11e52e022a53f8aed88

Analysis

Target
6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
Size 640KB
Sample220325-vptyfsaea2
SHA256 6f589e1d533cecf8a0a098a349c072dc2f6021a77bbca11e52e022a53f8aed88
MD5 6065d86eaf2b82bff0a3a1bb8dcdfa98
SHA1 2f8d5e13ef702b9f4149576a1ac256546371db87
SHA512 ffe6ba64ac9127f41bae0cc49e101e8adbd568bffaa8488a1db3a51e2eec427ba4d3f499e5cf1f46262429a3cf8a54e6890007e769a797524044f5d55bfa709f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1604	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27
PID 852 wrote to memory of 1604	852	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

memory/852-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/1604-56-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/1604-57-0x0000000000740000-0x0000000000764000-memory.dmp

Download